Network Security
Malware
Malware is software written to harm a computer, the data stored on it, or the person using it. Once it is running on a device it can carry out whatever it was written to do, and it may do several of these things at once.
| Effect | What it means |
|---|---|
| Delete or corrupt files | Files are removed or damaged so they will not open. Documents, music or saved games can be lost for good. |
| Change data | Details are altered without you noticing. A wrong date in a project plan or a changed score in a spreadsheet can cause problems later. |
| Copy and steal data | Malware sends copies of files or account details to someone else, so private information is no longer private. |
| Lock or encrypt files | Files are made unreadable or blocked, so even you cannot open them. This stops you using your own work. |
| Spy on activity | It records what you type, the sites you visit or the messages you send, watching what you do without permission. |
| Slow down or crash the computer | It uses up processing power, memory or storage, so programs lag, or the device freezes and stops responding. |
| Allow remote control | An attacker can operate the computer as if they were sitting at it, opening files, running programs and changing settings. |
These effects can happen together. A tablet used for homework and for editing videos could have its saved videos corrupted, its project file changed, a folder of half-finished videos copied to someone else, its whole homework folder locked and its browsing history read, all by the same piece of malware. The tablet might also slow to a crawl and let an attacker open apps on it remotely. Damage like this can be permanent: deleted files may not be recoverable and changed data may go unnoticed.
Malware is software written to harm a computer, its data or the person using it. It cannot get onto a device by itself — it needs a route in, and most routes involve something you open, install, click or plug in.
Ways malware gets in
- Infected email attachments — a file attached to a message, such as a photo or a form to fill in, that carries malware. Opening the file runs the hidden code, so a message that looks ordinary can still be dangerous.
- Untrusted downloads — installing a program from a website you do not know or trust. Something extra can be bundled in with the program you actually wanted.
- Links in phishing messages — a message pretending to be from a company you use, pushing you to click. The link downloads malware instead of opening the page it promised.
- Infected removable storage — a memory card from a camera or a borrowed external drive carries the malware with it. Open a file on it with a clean computer and the malware travels across.
- Unpatched software — software that has not been updated still contains known weaknesses. Malware written to exploit one gets in without you doing anything at all.
Hidden on purpose
Malware is usually disguised: a file name that sounds like something ordinary, an icon that copies a well-known app, or a folder you would never think to check. You run it without realising, which is exactly what the attacker is relying on.
A threat to the whole network
Once malware is running on one computer attached to a network, it can spread to the other computers on that network. That is the real threat: a single careless click can put every machine in a school or office at risk, not just the one it landed on, so the damage reaches far beyond the original device.
The purpose of a malware attack is what the attacker is trying to achieve by it. You can identify the purpose by asking what the attacker wants to happen; four common purposes are stealing data, extorting money, damaging or disrupting an organisation, and taking control of other people's devices.
Stealing data
Data is valuable, so a common purpose is to copy it and take it away. An attacker might copy the login details for thousands of player accounts from an online game and sell them on. The buyers then take over those accounts and sell the rare items inside them. Stolen details can also be used for fraud, such as taking out a mobile phone contract in someone else's name, or for identity theft, where the attacker pretends to be that person.
Extorting money
Extortion means forcing someone to pay. Malware may lock or encrypt a victim's files and then demand a payment before they can be opened again. A cat rescue centre could find its rehoming records locked, with a message demanding money for the unlock code. Paying does not guarantee that the files will come back.
Damaging and taking control
Some attacks are carried out to cause harm rather than to make money directly. Malware might delete a basketball club's match results, or stop the tills in a café from working for a day. The club cannot check its results and the café cannot serve customers until the systems are fixed.
An attacker may want to take over devices and use them for their own ends. Hundreds of smart TVs, baby monitors and other home devices could be taken over and then used together to flood a gaming website with traffic, while the owners carry on unaware that their devices are being used. Being in control of many machines gives the attacker far more power than controlling one.
A scenario question gives you a short story about an organisation and asks about the attack in it. When the attack is malware — software written to harm a computer, its data or the person using it — answer in four steps, tying each point to the story, because each one can earn a mark.
The four steps
- Identify the form of attack. Say it is malware. Calling it "bad software" is too vague to earn the mark.
- Describe how it was used. Pick out the method from the story: an infected email attachment opened, a file downloaded from an untrusted website, a link clicked in a phishing message, a file shared in a messaging app, or malware spreading from another computer on the network.
- Explain the purpose. Say what the attacker wanted: data stolen so it can be sold on or used to pretend to be someone else, money extorted, an organisation disrupted, or devices taken over.
- Describe the threats. Say what harm followed: data deleted, corrupted, changed or locked; data stolen; devices slowed or stopped; financial loss; reputation damage; legal action; spread to other computers.
Purpose is why the attack was carried out; threats are the damage it leaves behind, so keep the two apart. You do not need to name a type of malware: what it did and what it caused is what scores.
Worked example
A youth theatre uses a shared laptop for ticket bookings. A volunteer opens a file sent to the theatre's group chat from an unknown account. Malware installs and changes several seat prices in the booking spreadsheet to £0, and copies an unpublished play script stored on the laptop.
- Form of attack: malware, installed without the volunteer realising.
- How it was used: a file shared through a messaging app was opened, and the malware reached the booking spreadsheet on the shared laptop.
- Purpose: to disrupt ticket sales and to take the script, perhaps to leak it or sell it on.
- Threats: seats sell for £0, so ticket income is lost; a leaked script before opening night could mean legal action from the writer and damage to the theatre's reputation.